Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.

CVE-2026-55521 affects Yamcs, an open-source mission control framework, in versions prior to 5.12.8 and 5.13.2. The vulnerability involves missing authorization checks across multiple API endpoints including IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can exploit these gaps to read packet and event index metadata without proper privileges, alter COP-1 link state without ControlLinks privilege, and manipulate simulation time. These unauthorized operations can disclose sensitive telemetry metadata, disrupt telecommand handling, and compromise system integrity and availability. The vulnerability is particularly significant given Yamcs is used in space and mission-critical systems. Fixes have been released in versions 5.12.8 and 5.13.2.